Cross-Site Scripting Vulnerability in Rails::HTML::SafeListSanitizer of Rails Applications

CVE-2026-128069

What is CVE-2026-128069?

The rails-html-sanitizer is essential for sanitizing HTML content in Rails applications. Prior to version 1.7.2, the HTML4 and HTML5 variants of Rails::HTML::SafeListSanitizer share a single instance of Rails::HTML::PermitScrubber, allowing for potential data intermingling in multithreaded processes. If concurrent sanitization calls are made with differing tags or attributes, there is a risk of utilizing an incorrect allowlist, particularly if permissive settings allow a script element to be included. This may result in unsafe content being outputted under stricter security settings, leading to cross-site scripting vulnerabilities when rendered. Affected applications are those which are multithreaded, use variable allowlists, or otherwise do not provide for separate scrubbing mechanisms. This vulnerability has been rectified in version 1.7.2.

References